Using ArcSight logger is very helpful when integrated with your ESM; in terms of log collection, it comes very handy and is easy to use. It depends upon the requirement whether to go with the appliance or the virtual one, but the performance of the appliance version is excellent, which also comes with 10 GB internal storage. It is easy to implement and integrate with different log sources. The peering function is always useful when we have multiple loggers in place. Easy to create queries and reports. Review collected by and hosted on G2.com.

Sometimes the search query takes too long to search the logs if the duration applied is more than 24 hours and if the search is applied on multiple loggers. Sometimes you could face issues while adding new destinations. Review collected by and hosted on G2.com.